chore: Add Linear release automation for tags#2644
Merged
Conversation
- Purpose: add a tag-driven GitHub Actions workflow that syncs Unraid OS releases into Linear. - Before: creating a Git tag did not automatically create or update a Linear release for webgui. - Problem: release tracking in Linear required manual work and existing tags had no reusable backfill path. - New behavior: pushed tags and manually selected existing tags resolve to either the internal or public Linear pipeline. - How it works: hyphenated pre-release tags use LINEAR_INTERNAL_ACCESS_KEY, plain x.y.z tags use LINEAR_PUBLIC_ACCESS_KEY, and the workflow runs linear/linear-release-action without completing releases.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughNew GitHub Actions workflow that resolves pushed or manually supplied Git tags, classifies them as internal or public releases, selects the matching Linear API key, runs the appropriate ChangesLinear Release Sync Workflow
Sequence DiagramsequenceDiagram
participant GitHub as GitHub Actions
participant Git as Git Repository
participant Resolver as Tag Resolution Logic
participant SecretMgr as Secret Validation
participant LinearAction as linear-release-action
participant Summary as Step Summary
GitHub->>Git: Checkout tag with full history
Git-->>GitHub: Repository ready
GitHub->>Resolver: Resolve tag name from ref/input
Resolver->>Git: Validate tag exists
Git-->>Resolver: Tag confirmed
Resolver->>Resolver: Determine channel (internal/public)
Resolver-->>GitHub: Export tag_name, release_name, release_channel
GitHub->>SecretMgr: Validate Linear key secret for release_channel
SecretMgr-->>GitHub: Secret verified (or fail)
alt channel = internal
GitHub->>LinearAction: Sync internal release with internal API key
LinearAction-->>GitHub: release_url output
else channel = public
GitHub->>LinearAction: Sync public release with public API key
LinearAction-->>GitHub: release_url output
end
GitHub->>Summary: Append execution result (channel, tag, release_url)
Summary-->>GitHub: Summary written to step output
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
elibosley
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/linear-release.yml:
- Around line 33-35: The workflow uses floating action tags (actions/checkout@v4
and linear/linear-release-action@v0); replace each of those three references
with their corresponding full commit SHAs to make them immutable, and add a
trailing inline comment indicating the original semantic tag (e.g., "# v4" or "#
v0") for maintainability; update the occurrences referenced as
actions/checkout@v4 and linear/linear-release-action@v0 accordingly so the
workflow references the SHA pins instead of the floating tags.
- Around line 120-164: The summary step ("Summarize Linear release") currently
only checks RELEASE_URL to decide if a release was created, which misreports
failures as "no Linear release"; pass the job status into the step (e.g. add env
JOB_STATUS: ${{ job.status }}) and in the run block check JOB_STATUS first (if
JOB_STATUS != "success" echo a failure line referencing TAG_NAME and JOB_STATUS)
before treating an empty RELEASE_URL as a no-op, updating the conditional that
emits "no Linear release was created or updated" to only be used when JOB_STATUS
is "success" and RELEASE_URL is empty.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: e6ddadcd-d481-47ce-8a81-a497a43be30b
📒 Files selected for processing (1)
.github/workflows/linear-release.yml
Comment on lines
+33
to
+35
| uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag_name || github.ref_name }} |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Check if the file exists and read the relevant sections
if [ -f ".github/workflows/linear-release.yml" ]; then
echo "=== File exists. Checking line 33-35 ==="
sed -n '33,35p' .github/workflows/linear-release.yml
echo ""
echo "=== Checking lines 105-118 ==="
sed -n '105,118p' .github/workflows/linear-release.yml
echo ""
echo "=== Full file for context ==="
cat -n .github/workflows/linear-release.yml
else
echo "File does not exist"
fiRepository: unraid/webgui
Length of output: 7533
Pin action references to immutable SHAs.
These steps use floating action tags (@v4, @v0). GitHub's security guidance calls full-length commit SHAs the only immutable way to reference actions, and that matters here because the Linear action is an external action that receives pipeline access keys. (docs.github.com)
Replace all three action references with their full commit SHAs:
- Line 33:
actions/checkout@v4 - Lines 105 and 114:
linear/linear-release-action@v0
Include version tag comments for maintainability (e.g., # v4, # v0).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/linear-release.yml around lines 33 - 35, The workflow uses
floating action tags (actions/checkout@v4 and linear/linear-release-action@v0);
replace each of those three references with their corresponding full commit SHAs
to make them immutable, and add a trailing inline comment indicating the
original semantic tag (e.g., "# v4" or "# v0") for maintainability; update the
occurrences referenced as actions/checkout@v4 and
linear/linear-release-action@v0 accordingly so the workflow references the SHA
pins instead of the floating tags.
- Purpose: make the Linear release workflow summary distinguish failed sync attempts from successful no-op runs. - Before: the always-running summary step only checked for a release URL and reported missing URLs as no release created. - Problem: failed or cancelled jobs could be misreported as harmless no-op release syncs. - New behavior: the summary receives job.status and reports non-success statuses before checking for a release URL. - How it works: JOB_STATUS is passed into the summary step and the no-release message is only emitted after a successful job with an empty release URL.
This was referenced May 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a GitHub Actions workflow that syncs Linear releases when Unraid OS tags are pushed, with a manual dispatch path for backfilling existing tags.
Behavior
tag_namefor existing tags.LINEAR_INTERNAL_ACCESS_KEY.7.3.0to the public Linear pipeline viaLINEAR_PUBLIC_ACCESS_KEY.Unraid OS <tag>without completing the release.Validation
.github/workflows/linear-release.ymlwith Ruby YAML loading.LINEAR_ACCESS_KEYsecret.Summary by CodeRabbit
Chores